CVE-2020-12826

Published: 12 May 2020

A signal access-control issue was discovered in the Linux kernel before 5.6.5, aka CID-7395ea4e65c2. Because exec_id in include/linux/sched.h is only 32 bits, an integer overflow can interfere with a do_notify_parent protection mechanism. A child process can send an arbitrary signal to a parent process in a different security domain. Exploitation limitations include the amount of elapsed time before an integer overflow occurs, and the lack of scenarios where signals to a parent process present a substantial operational threat.

From the Ubuntu Security Team

It was discovered that the exit signaling implementation in the Linux kernel contained an integer overflow. A local attacker could use this to cause a denial of service (arbitrary application crash).

Status

Severity score breakdown

References

• https://git.kernel.org/linus/d1e7fd6462ca9fc76650fbe6ca800e35b24267da
• https://bugzilla.redhat.com/show_bug.cgi?id=1822077
• https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.6.5
• https://github.com/torvalds/linux/commit/7395ea4e65c2a00d23185a3f63ad315756ba9cef
• https://lists.openwall.net/linux-kernel/2020/03/24/1803
• https://www.openwall.com/lists/kernel-hardening/2020/03/25/1
• https://ubuntu.com/security/notices/USN-4367-1
• https://ubuntu.com/security/notices/USN-4369-1
• https://ubuntu.com/security/notices/USN-4391-1
• https://www.cve.org/CVERecord?id=CVE-2020-12826
• NVD
• Launchpad
• Debian